First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Can be prevented setting persistent new password

aballok

Summary

Malicious attacker can prevent you from changing password

Vulnerability Details

Attacker can change the password back to previous original password or other password not the one owner wants to change to, everytime owner changes the password. They can monitor transactions for password change and immediately call function setPassword(string memory newPassword) external which has no access control

Impact

This implies key requirement to "* You can update your password at any time." is violated as you can never set a persistent password

Tools Used

Manual Analysis

Recommendations

Ensure function has access control so only called by contract owne e.g

function setPassword(string memory newPassword) external {
require(msg.sender == s_owner, "not owner");
s_password = newPassword;
emit SetNetPassword();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.